| Project Detail |
Self-aware and self-optimising static program analysis improves code development
In contrast to dynamic program analysis done while a program is being executed, static program analysis is used to identify potential problems before code is deployed. This can efficiently analyse individual and smaller subprograms to ensure they are correctly written before integrating and running them in a larger program. However, poorly adapted analyses can produce false warnings or require long times, slowing down program development rather than efficiently expediting it. The ERC-funded SOSA project aims to develop the first example of self-aware and self-optimising static program analysis that will continuously analyse and optimise not only the tested programs but the analysis itself. This should minimise false warnings and analysis time automatically.
Software systems pervade our personal and professional lives, yet their insecurity threaten our society. To assure that software systems are dependable and secure, one must reason about their code. Static program analysis enables such reasoning. It can be applied to individual software components, and it can show not only the presence but also prove the absence of bugs and vulnerabilities. Yet, to be useful to software developers, static analyses must be adapted to the context in which they are used. Studies show that poorly adapted analyses slow down rather than assist development. They report large sets of false warnings that distract developers from actual bugs, which the analyses often miss. They often run so long that results are reported when they are already outdated. SOSA’s main research hypothesis is that one can generate precise and efficient static analyses of software systems by making static analysis self-aware and self-optimizing. With SOSA, a static analysis conducts analyses and optimizations not just of programs but of itself. This is a groundbreaking paradigm shift: no previous research has regarded complex program analyses themselves as the primary object of automated analysis and optimization. SOSA will introduce, for the first time, static analyses whose execution is not pre-defined by their creators but is inherently self-adaptive. In result, analyses automatically adapt themselves to yield a performance/precision tradeoff that is optimal with respect to how the analysis is deployed and which program it analyzes. With SOSA, static analyses will report true and relevant warnings at minimal analysis time without requiring manual optimizations by end users. SOSA will boost progress in the field of program-analysis research, mapping the landscape of static-analysis optimizations and how and where they are best applied. By enabling software developers to optimally deploy static analyses with ease, SOSA will help secure millions of software systems. |
